| 2026-10-06 |
WPSEC-2026-0481 |
Motors – Car Dealership & Classified Listings | Motors – Car Dealership & Classified Listings <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter |
Medium 6.4 |
1.4.125 |
| 2026-10-06 |
WPSEC-2026-0480 |
User Activity Tracking and Log | User Activity Tracking and Log <= 4.3.1 - Unauthenticated IP Address Spoofing via Client-IP Header |
Medium 5.3 |
4.3.2 |
| 2026-10-06 |
WPSEC-2026-0479 |
Form Maker by 10Web | Form Maker by 10Web <= 1.15.47 - Unauthenticated Reflected Cross-Site Scripting via 'inputs' Parameter Keys |
Medium 6.1 |
1.15.48 |
| 2026-10-06 |
WPSEC-2026-0478 |
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress | LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Authenticated (Instructor's Assistant+) PHP Object Injection via Course Builder Custom Fields |
High 7.5 |
10.3.0 |
| 2026-10-06 |
WPSEC-2026-0477 |
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress | LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Unauthenticated Sensitive Information Exposure via RSS Feeds |
Medium 5.3 |
10.3.0 |
| 2026-10-06 |
WPSEC-2026-0476 |
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress | LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress <= 10.2.1 - Authenticated (Instructor's Assistant+) PHP Object Injection via Lesson Clone and Course Import |
High 7.5 |
10.3.0 |
| 2026-10-06 |
WPSEC-2026-0475 |
Zero Spam for WordPress | Zero Spam for WordPress <= 5.7.11 - Unauthenticated Country Block Bypass via 'CF-IPCountry' and 'X-Forwarded-Country' Headers |
Low 3.7 |
5.7.12 |
| 2026-10-06 |
WPSEC-2026-0474 |
Zero Spam for WordPress | Zero Spam for WordPress <= 5.7.11 - Unauthenticated Login Protection Bypass via 'woocommerce-login-nonce' and 'pp_current_url' Parameters |
Medium 5.3 |
5.7.12 |
| 2026-10-06 |
WPSEC-2026-0473 |
WP Attachments | WP Attachments <= 6.0.3 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'download' Parameter |
Medium 5.3 |
6.1 |
| 2026-10-06 |
WPSEC-2026-0472 |
WooCommerce EU VAT Assistant | WooCommerce EU VAT Assistant <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via VAT Number |
High 7.2 |
2.2.0.261001 |
| 2026-10-06 |
WPSEC-2026-0471 |
Event Booking Manager for WooCommerce | Event Booking Manager for WooCommerce <= 5.7.5 - Unauthenticated Missing Authorization to Paid Event RSVP Registration and Online Event Details Disclosure |
Medium 4.8 |
5.7.6 |
| 2026-10-06 |
WPSEC-2026-0470 |
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via Subscriber Name and Custom Field Values |
Medium 6.1 |
11.1.1 |
| 2026-10-06 |
WPSEC-2026-0469 |
Extensions For CF7 | Extensions For CF7 <= 3.4.5 - Unauthenticated Limited Arbitrary File Upload via Signature Field |
High 8.1 |
3.4.6 |
| 2026-10-06 |
WPSEC-2026-0468 |
GeoDirectory | GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Email Custom Field |
Medium 5.4 |
2.8.189 |
| 2026-10-06 |
WPSEC-2026-0467 |
WP Meteor Website Speed Optimization Addon | WP Meteor Website Speed Optimization Addon <= 3.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via onload/onerror Attribute Rewriting |
Medium 6.4 |
3.4.19 |
| 2026-10-06 |
WPSEC-2026-0466 |
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'result_id' and 'qsm_unique_key' Parameters |
High 7.3 |
11.2.8 |
| 2026-10-06 |
WPSEC-2026-0465 |
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Question Modification and Deletion |
Medium 5.4 |
11.2.8 |
| 2026-10-06 |
WPSEC-2026-0464 |
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection via Quiz Settings |
High 7.5 |
11.2.8 |
| 2026-10-06 |
WPSEC-2026-0463 |
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Length Settings |
Medium 6.4 |
11.2.8 |
| 2026-10-06 |
WPSEC-2026-0462 |
YOP Poll | YOP Poll <= 7.0.12 - Unauthenticated Information Exposure of Results on Registered-Only Polls |
Medium 5.3 |
7.0.13 |
| 2026-10-06 |
WPSEC-2026-0461 |
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.4 - Unauthenticated Admin Email Flooding via subscribe_to_email_list |
Medium 5.3 |
1.2.78.5 |
| 2026-10-06 |
WPSEC-2026-0460 |
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection via Clone/Restore Database Values |
High 7.5 |
6.2.2 |
| 2026-10-06 |
WPSEC-2026-0459 |
WPC Smart Quick View for WooCommerce | WPC Smart Quick View for WooCommerce <= 4.4.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Products in Quick View |
Medium 5.3 |
4.4.2 |
| 2026-10-06 |
WPSEC-2026-0458 |
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Authenticated (Subscriber+) Missing Authorization to Application-Level Microsoft Graph Access via 'application' Parameter |
High 8.2 |
45.0 |
| 2026-10-06 |
WPSEC-2026-0457 |
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via ID Token Claims in Health Messages |
High 7.2 |
45.0 |
| 2026-10-06 |
WPSEC-2026-0456 |
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Authenticated (Subscriber+) Server-Side Request Forgery via Microsoft Graph Proxy |
High 7.1 |
45.0 |
| 2026-10-06 |
WPSEC-2026-0455 |
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via Missing ID Token Issuer and Audience Validation |
Medium 6.5 |
45.0 |
| 2026-10-06 |
WPSEC-2026-0454 |
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection via 'pms-view' Parameter on Payments List |
Medium 6.5 |
3.1.2 |
| 2026-10-06 |
WPSEC-2026-0453 |
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection via 'pms-view' Parameter on Members List |
Medium 6.5 |
3.1.2 |
| 2026-10-06 |
WPSEC-2026-0452 |
Appointment Booking Plugin | Appointment Booking Plugin <= 5.7.3 - Unauthenticated Sensitive Information Exposure via Template Variable Injection in Customer Name and Notes |
Medium 5.3 |
5.7.4 |
| 2026-10-06 |
WPSEC-2026-0451 |
Appointment Booking Plugin | Appointment Booking Plugin <= 5.7.3 - Unauthenticated Insecure Direct Object Reference to Cart Item Modification via 'active_cart_item[id]' |
Medium 5.3 |
5.7.4 |
| 2026-10-06 |
WPSEC-2026-0450 |
Admin and Site Enhancements (ASE) | Admin and Site Enhancements (ASE) <= 9.1.4 - Unauthenticated Denial of Service via 'asenha_password_protection' Cookie |
Medium 5.9 |
9.2.0 |
| 2026-10-06 |
WPSEC-2026-0449 |
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Missing Authorization to Booking Status Update |
Medium 5.3 |
4.1.26 |
| 2026-10-06 |
WPSEC-2026-0448 |
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Sensitive Information Exposure via Event Structured Data |
Low 3.7 |
4.1.26 |
| 2026-10-06 |
WPSEC-2026-0447 |
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Sensitive Information Exposure via Event REST API |
Medium 5.3 |
4.1.26 |
| 2026-10-06 |
WPSEC-2026-0446 |
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Payment Bypass via Mismatched Order Attendees |
Medium 5.3 |
4.1.26 |
| 2026-10-06 |
WPSEC-2026-0445 |
YITH WooCommerce Compare | YITH WooCommerce Compare <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_woocompare_counter Shortcode Attributes |
Medium 6.4 |
3.15.0 |
| 2026-10-06 |
WPSEC-2026-0444 |
Wallet for WooCommerce | Wallet for WooCommerce <= 1.7.0 - Authenticated (Vendor+) Incorrect Authorization to Wallet Partial Payment Refund |
Low 3.1 |
1.7.1 |
| 2026-10-06 |
WPSEC-2026-0443 |
Wallet for WooCommerce | Wallet for WooCommerce <= 1.7.0 - Cross-Site Request Forgery to Wallet Partial Payment Refund |
Medium 4.3 |
1.7.1 |
| 2026-10-06 |
WPSEC-2026-0442 |
Hustle – Email Marketing, Lead Generation, Optins, Popups | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization to Authenticated (Subscriber+) Non-Public Post Title Disclosure |
Medium 4.3 |
7.8.14.3 |
| 2026-10-06 |
WPSEC-2026-0441 |
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.41 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Archive Title Block |
Medium 4.9 |
5.1.0 |
| 2026-10-06 |
WPSEC-2026-0440 |
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.41 - Authenticated (Subscriber+) Sensitive Information Exposure via Localized Plugin Settings |
Medium 4.3 |
5.1.0 |
| 2026-10-06 |
WPSEC-2026-0439 |
Responsive Lightbox & Gallery | Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via GLightbox Slide Options |
Medium 6.4 |
2.7.10 |
| 2026-10-06 |
WPSEC-2026-0438 |
Responsive Lightbox & Gallery | Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nivo Lightbox HiDPI Image Source |
Medium 4.4 |
2.7.10 |
| 2026-10-06 |
WPSEC-2026-0437 |
Responsive Lightbox & Gallery | Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Link Title Attribute |
Medium 6.4 |
2.7.10 |
| 2026-10-06 |
WPSEC-2026-0436 |
Master Slider | Master Slider <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode Attributes |
Medium 6.4 |
3.11.3 |
| 2026-10-06 |
WPSEC-2026-0435 |
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Bar Page Settings |
Medium 6.4 |
3.50.1 |
| 2026-10-05 |
WPSEC-2026-0434 |
Site Reviews | Site Reviews <= 8.3.3 - Authenticated (Subscriber+) Missing Authorization to User Information Exposure via REST Shortcode Options Endpoint |
Medium 4.3 |
8.3.4 |
| 2026-10-05 |
WPSEC-2026-0433 |
Page Builder by SiteOrigin | Page Builder by SiteOrigin <= 2.36.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'panels_data' Post Meta |
Medium 6.4 |
2.37.0 |
| 2026-10-05 |
WPSEC-2026-0432 |
Rate My Post – Star Rating Plugin by FeedbackWP | Rate My Post – Star Rating Plugin by FeedbackWP <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Top Rated Posts Widget |
Medium 6.4 |
4.5.3 |
| 2026-10-05 |
WPSEC-2026-0431 |
Unlimited Elements For Elementor | Unlimited Elements For Elementor <= 2.0.22 - Authenticated (Contributor+) Limited Arbitrary Function Call via Post List 'includeby_function_name' Setting |
High 7.6 |
2.0.23 |
| 2026-10-04 |
WPSEC-2026-0430 |
Salon booking system | Salon booking system <= 10.31.8 - Unauthenticated Sensitive Information Exposure via PWA index.html Access Token |
Critical 9.8 |
10.31.9 |
| 2026-10-04 |
WPSEC-2026-0429 |
Salon booking system | Salon booking system <= 10.31.8 - Unauthenticated Authentication Bypass via Predictable Zapier API Key |
Medium 6.5 |
10.31.9 |
| 2026-10-04 |
WPSEC-2026-0428 |
Salon booking system | Salon booking system <= 10.31.8 - Unauthenticated Authentication Bypass via Predictable REST API Access Tokens |
High 8.1 |
10.31.9 |
| 2026-10-04 |
WPSEC-2026-0427 |
GEO Plugin by Squirrly SEO | GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via sq_keyword Custom Field |
Medium 6.4 |
14.2.7 |
| 2026-10-04 |
WPSEC-2026-0426 |
GEO Plugin by Squirrly SEO | GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Editor+) Missing Authorization to Arbitrary Plugin Settings Update |
Low 2.7 |
14.2.7 |
| 2026-10-04 |
WPSEC-2026-0425 |
GEO Plugin by Squirrly SEO | GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Facebook Pixel Code |
Medium 6.4 |
14.2.7 |
| 2026-10-04 |
WPSEC-2026-0424 |
GEO Plugin by Squirrly SEO | GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Page SEO Modification |
Medium 4.3 |
14.2.7 |
| 2026-10-04 |
WPSEC-2026-0423 |
GEO Plugin by Squirrly SEO | GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure |
Medium 4.3 |
14.2.7 |
| 2026-10-04 |
WPSEC-2026-0422 |
GEO Plugin by Squirrly SEO | GEO Plugin by Squirrly SEO < 14.2.7 - Authenticated (Editor+) Arbitrary File Read via Favicon Setting |
Medium 4.9 |
14.2.7 |
| 2026-10-04 |
WPSEC-2026-0421 |
WP Mailster | WP Mailster <= 1.9.0.0 - Authenticated (Contributor+) Missing Authorization to Mail Server Settings Exposure and Modification |
High 7.6 |
1.9.1.0 |
| 2026-10-04 |
WPSEC-2026-0420 |
WP Mailster | WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting via Subscriber Name |
High 7.2 |
1.9.1.0 |
| 2026-10-04 |
WPSEC-2026-0419 |
GoodMeet | GoodMeet <= 2.0.0 - Authenticated (Contributor+) Missing Authorization to Restricted Meeting Disclosure via 'goodmeet-google-meeting' Shortcode |
Medium 4.3 |
2.1.0 |
| 2026-10-04 |
WPSEC-2026-0418 |
GoodMeet | GoodMeet <= 2.0.0 - Unauthenticated Sensitive Information Exposure via 'goodmeet_meeting_list' AJAX Action |
Medium 5.3 |
2.1.0 |
| 2026-10-04 |
WPSEC-2026-0417 |
Mapster WP Maps | Mapster WP Maps <= 2.0.4 - Reflected Cross-Site Scripting via 'id' Parameter |
Medium 6.1 |
2.0.5 |
| 2026-10-04 |
WPSEC-2026-0416 |
Ni WooCommerce Payment Gateway Charges | Ni WooCommerce Payment Gateway Charges < 1.7.0 - Missing Authorization to Unauthenticated Settings Update |
Medium 5.3 |
1.7.0 |
| 2026-10-04 |
WPSEC-2026-0415 |
Split Pay for Stripe on WooCommerce | Split Pay for Stripe on WooCommerce <= 3.8.4 - Authenticated (Vendor+) Missing Authorization to Dokan Supplier Vendor Payout Modification |
Medium 4.3 |
3.8.5 |
| 2026-10-04 |
WPSEC-2026-0414 |
SMS Alert | SMS Alert <= 4.0.0 - Unauthenticated OTP Verification Bypass via Form Submission |
Medium 5.3 |
4.0.1 |
| 2026-10-04 |
WPSEC-2026-0413 |
SMS Alert | SMS Alert <= 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP |
High 8.1 |
4.0.1 |
| 2026-10-04 |
WPSEC-2026-0412 |
Advanced Form Integration | Advanced Form Integration <= 2.9.0 - Unauthenticated Privilege Escalation via Account Takeover in Ultimate Member 'Update Profile Field' Action |
High 8.1 |
2.10.0 |
| 2026-10-03 |
WPSEC-2026-0411 |
Fattura24 | Fattura24 <= 8.1.15 - Unauthenticated Sensitive Information Exposure via Log Files |
High 7.5 |
8.2.0 |
| 2026-10-03 |
WPSEC-2026-0410 |
Fattura24 | Fattura24 <= 8.1.15 - Unauthenticated Sensitive Information Exposure via Predictable Document PDF File Names |
Medium 5.3 |
8.2.0 |
| 2026-10-03 |
WPSEC-2026-0409 |
Better Sharing | Better Sharing <= 2.9.0 - Unauthenticated Content Injection via Share Email REST Route |
Medium 5.3 |
2.10.0 |
| 2026-10-03 |
WPSEC-2026-0408 |
Better Sharing | Better Sharing <= 2.9.0 - Missing Authorization to Unauthenticated Arbitrary Email Sending via Test Email REST Route |
Medium 5.3 |
2.10.0 |
| 2026-10-03 |
WPSEC-2026-0407 |
Wicked Folders | Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Screen State Overwrite via REST API |
Medium 4.3 |
4.2.0 |
| 2026-10-03 |
WPSEC-2026-0406 |
Wicked Folders | Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Missing Authorization to Folder Assignment of Arbitrary Posts via REST API |
Medium 4.3 |
4.2.0 |
| 2026-10-03 |
WPSEC-2026-0405 |
GPTranslate | GPTranslate <= 2.34.12 - Unauthenticated Stored Cross-Site Scripting via Translated Attributes in the DOMDocument Rendering Method |
Medium 5.4 |
2.34.13 |
| 2026-10-03 |
WPSEC-2026-0404 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Brute Force Protection Bypass |
Medium 4.8 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0403 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content |
Medium 6.3 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0402 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Sensitive Information Exposure via Member Directory Filters |
Medium 5.3 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0401 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Privilege Escalation via Registration Form ID Tampering |
High 8.1 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0400 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Content Restriction Bypass via REST API |
Medium 5.3 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0399 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Limited File Upload via Non-File Custom Fields |
Medium 5.3 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0398 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Reflected Cross-Site Scripting via 'start_date' and 'end_date' Parameters |
Medium 6.1 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0397 |
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Reflected Cross-Site Scripting via Member Directory Date Filter |
Medium 6.1 |
4.17.6 |
| 2026-10-03 |
WPSEC-2026-0396 |
WP User Manager – User Profile Builder & Membership | WP User Manager – User Profile Builder & Membership <= 2.9.21 - Unauthenticated Sensitive Information Exposure via REST API |
Medium 5.3 |
2.9.22 |
| 2026-10-03 |
WPSEC-2026-0395 |
WP Captcha PRO | WP Captcha PRO <= 5.40 - Unauthenticated CAPTCHA Bypass via 'rest_route' Parameter |
Medium 5.3 |
5.41 |
| 2026-10-03 |
WPSEC-2026-0394 |
WP Captcha PRO | WP Captcha PRO <= 5.40 - Unauthenticated Login CAPTCHA and Lockout Bypass for Incorrect Passwords |
Medium 5.3 |
5.41 |
| 2026-10-03 |
WPSEC-2026-0393 |
Animated Number Counters | Animated Number Counters <= 2.9 - Authenticated (Editor+) SQL Injection via 'rearrange_counter_list' Parameter |
Medium 4.9 |
3.1 |
| 2026-10-03 |
WPSEC-2026-0392 |
Import and export users and customers | Import and export users and customers <= 2.5.6 - Authenticated (Custom+) Privilege Escalation via Account Takeover in Cron Import |
High 7.2 |
2.5.7 |
| 2026-10-03 |
WPSEC-2026-0391 |
SiteOrigin Widgets Bundle | SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection in Widget Style Values |
Medium 6.5 |
1.75.0 |
| 2026-10-03 |
WPSEC-2026-0390 |
AI Puffer – Chat. Create. Automate. (formerly AI Power) | AI Puffer – Chat. Create. Automate. (formerly AI Power) <= 2.4.89 - Authenticated (Knowledge Base Access) Missing Authorization to Content Indexing Settings Update |
Low 3.1 |
2.4.90 |
| 2026-10-03 |
WPSEC-2026-0389 |
AI Puffer – Chat. Create. Automate. (formerly AI Power) | AI Puffer – Chat. Create. Automate. (formerly AI Power) <= 2.4.89 - Authenticated (Knowledge Base Access) Missing Authorization to Semantic Search Settings Update |
Low 3.1 |
2.4.90 |
| 2026-10-03 |
WPSEC-2026-0388 |
404 Solution | 404 Solution <= 4.3.5 - Unauthenticated Open Redirect via Regex Redirect Captures |
Medium 4.7 |
4.3.6 |
| 2026-10-03 |
WPSEC-2026-0387 |
Import and export users and customers | Import and export users and customers <= 2.5.5 - Authenticated (Custom+) Missing Authorization to User Role Removal via Import and Cron Settings |
Medium 4.9 |
2.5.6 |
| 2026-10-03 |
WPSEC-2026-0386 |
Comment Cleaner — Bulk Delete & Disable Comments | Comment Cleaner — Bulk Delete & Disable Comments <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Comment Deletion |
Medium 4.3 |
7.2 |
| 2026-10-03 |
WPSEC-2026-0385 |
JS Job Manager | JS Job Manager < 2.0.3 - Unauthenticated Arbitrary File Deletion via Company Deletion |
Critical 9.1 |
2.0.3 |
| 2026-10-03 |
WPSEC-2026-0384 |
JS Job Manager | JS Job Manager < 2.0.3 - Unauthenticated Privilege Escalation via Post Installation Wizard |
Critical 9.8 |
2.0.3 |
| 2026-10-03 |
WPSEC-2026-0383 |
JS Job Manager | JS Job Manager < 2.0.3 - Unauthenticated Stored Cross-Site Scripting via Resume Video Field |
High 7.2 |
2.0.3 |
| 2026-10-03 |
WPSEC-2026-0382 |
Form Block | Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data |
High 7.2 |
1.8.2 |
